mirror of
https://github.com/juanfont/headscale.git
synced 2025-10-31 16:11:03 +01:00
35bfe7ced0
* Add support for service reload and sync service file * Copy the systemd.service file to the manual linux docs and adjust the path to the headscale binary to match with the previous documentation blocks. Unfortunately, there seems to be no easy way to include a file in mkdocs. * Remove a redundant "deprecation" block. The beginning of the documentation already states that. * Add `ExecReload` to the systemd.service file. Fixes: #2016 * Its called systemd * Fix link to systemd homepage
53 lines
1.2 KiB
Desktop File
53 lines
1.2 KiB
Desktop File
[Unit]
|
|
After=syslog.target
|
|
After=network.target
|
|
Description=headscale coordination server for Tailscale
|
|
X-Restart-Triggers=/etc/headscale/config.yaml
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=headscale
|
|
Group=headscale
|
|
ExecStart=/usr/bin/headscale serve
|
|
ExecReload=/usr/bin/kill -HUP $MAINPID
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
WorkingDirectory=/var/lib/headscale
|
|
ReadWritePaths=/var/lib/headscale /var/run
|
|
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_CHOWN
|
|
LockPersonality=true
|
|
NoNewPrivileges=true
|
|
PrivateDevices=true
|
|
PrivateMounts=true
|
|
PrivateTmp=true
|
|
ProcSubset=pid
|
|
ProtectClock=true
|
|
ProtectControlGroups=true
|
|
ProtectHome=true
|
|
ProtectHostname=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
RemoveIPC=true
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
RuntimeDirectory=headscale
|
|
RuntimeDirectoryMode=0750
|
|
StateDirectory=headscale
|
|
StateDirectoryMode=0750
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@chown
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|